5101:1-37-01.1 Medicaid: safeguarding and releasing information.

(A) This rule describes the requirements of disclosing information, maintaining confidentiality and safeguarding information for an individual participating in a medical assistance program. No information shall be released to anyone except as provided in sections 5101.26 to 5101.271 of the Revised Code.

(B) Definition of safeguard. "Safeguard" means security measures that need to be taken to ensure that federal tax information (FTI) of medicaid individuals is protected against unauthorized inspection or disclosure and use. Safeguarding also refers to the restriction on the use of, or disclosure of, individual information.

(C) Administrative agency responsibilities. The administrative agency shall:

(1) Follow the safeguarding guidelines for protecting federal tax returns and federal tax return information as described in the internal revenue service (IRS) publication 1075 (as in effect November 1, 2009).

(2) Safeguard information about individuals by restricting the use of, or disclosure of, information concerning individuals to purposes directly connected with the administration of the medicaid program in accordance with 42 C.F.R. 431.302 (as in effect November 1, 2009). Purposes directly related to the administration of the medicaid program include:

(a) Establishing eligibility;

(b) Determining the amount of medical assistance;

(c) Providing services for individuals; and

(d) Conducting or assisting an investigation, prosecution, or civil or criminal proceeding.

(3) Publicize provisions governing the confidential nature of information about individuals. The agency shall provide copies of these provisions to individuals and to other persons and agencies to whom information is disclosed in accordance with 42 C.F.R. 431.304 (as in effect November 1, 2009).

(4) Protect the types of information about individuals that are safeguarded in accordance with 42 C.F.R. 431.305 (as in effect November 1, 2009). The information shall include:

(a) Names and addresses;

(b) Medical services provided;

(c) Social and economic conditions or circumstances;

(d) Administrative agency evaluation of personal information;

(e) Medical data, including diagnosis and past history of disease or disability;

(f) Any information received for verifying income eligibility and amount of medical assistance payments. Income information received from the social security administration or the internal revenue service shall be safeguarded according to the requirements of the agency furnishing the data.

(g) Any information received in connection with the identification of legally liable third party resources, in accordance with 42 C.F.R. 433.138 (as in effect on November 1, 2009).

(5) Release information as permitted in accordance with sections 5101.27 and 5101.271 of the Revised Code. Information and records, but only the minimum necessary to fulfill the need for the sharing of information concerning an individual, shall be released.

(6) Obtain a Health Insurance Portability and Accountability Act of 1996 (HIPAA) compliant authorization form when requests for information are received or when information is provided about the health care of an individual, the health care provided to an individual, or the payment for the provision of health care for an individual, in accordance with 45 C.F.R. 164.508 (as in effect November 1, 2009).

(7) Not release medical, psychiatric or psychological information to an individual or authorized representative if the administrative agency has reason to believe that the release may have an adverse effect on the individual, as provided in section 5122.31 of the Revised Code.

(8) Establish criteria specifying the conditions for release and use of information about individuals. The information must be restricted to persons or agency representatives who are subject to standards of confidentiality that are comparable to those of the agency in accordance with 42 C.F.R. 431.306(a) and (b) (as in effect November 1, 2009).

(9) Not publish names of individuals in accordance with 42 C.F.R. 431.306(c) (as in effect November 1, 2009).

(10) Obtain permission from an individual or authorized representative whenever releasing information, unless that information is used to verify income or eligibility (IEVS) in accordance with 42 C.F.R. 431.306(d) (as in effect November 1, 2009).

(11) Apply policies to all requests for information from outside sources, including governmental bodies, courts of law, or law enforcement officials except as provided in sections 5101.26 to 5101.30 of the Revised Code (as in effect on November 1, 2009).

(12) Distribute materials to individuals in accordance with 42 C.F.R. 431.307 (as in effect November 1, 2009). The materials shall:

(a) Have no political implications except to the extent required to implement the National Voter Registration Act (NVRA) of 1993.

(b) Include voter information and registration materials as provided in section 3503.10 of the Revised Code (as in effect on November 1, 2009).

(c) Contain only the names of individuals directly connected with the administration of the medicaid program and shall identify those individuals only in their official capacity.

(d) Not be materials such as holiday greetings, general public announcements, partisan voting information and alien registration notices.

(13) Have the authority to distribute materials directly related to the health and welfare of individuals, such as announcements of free medical examinations, availability of surplus food, and consumer protection information.

Replaces: 5101:1-37- 01.1

Effective: 11/01/2009
R.C. 119.032 review dates: 11/01/2014
Promulgated Under: 111.15
Statutory Authority: 5111.01 , 5111.011
Rule Amplifies: 307.981 , 329.01 , 1347, 3503.10 , 5101.30 , 5111.01 , 5111.011 , 5122.31 , 5703.211
Prior Effective Dates: 4/14/03 (Emer), 7/1/03